Why Is an IAM Request Body Truncated When a User Has Excessive User Groups or Roles Configured?

Symptom

If a user is assigned too many groups or roles, IAM truncates the request body and displays the following error message.

Possible Causes

The number of characters in the policy parameter of the IAM API request body exceeds the upper limit, causing the request body to be truncated.

Handling Procedure

Guardian traverses all user groups and roles assigned to the user. During traversal, Guardian skips the roles configured in token.server.manager.internal.roles and the user groups configured in token.server.manager.internal.groups. It then adds #W and #R labels to the remaining user groups and roles to construct the policy parameter in the IAM request body.

If the preceding error occurs, perform either of the following workarounds:

• Workaround 1: Reduce the number of groups or roles assigned to the user.
  1. Log in to MRS Manager. For details, see Accessing MRS Manager.
  2. Choose System > Permission > User, click Modify in the Operation column of the target user, and delete user groups or roles as required.
  3. After completing the modification, click OK.
  4. Resend the request.
• Workaround 2: Modify Guardian configurations. Add other user groups or roles to the filter list based on the default values, as required.
  1. Search for the IAM request body near the error log using the keyword GetSecurityKey requestBody is, and check the user groups and roles contained in the obs:accesslabel label within the request body. Identify and record any user groups or roles that do not require OBS path authorization.
  2. Log in to MRS Manager. For details, see Accessing MRS Manager.
  3. Choose Cluster > Services > Guardian, click Configurations and then All Configurations, choose Customization, and add the following parameters to token.server.config.expandor.

     Table 1 Filtering user groups and roles from OBS path authorization

     Parameter	Description
     token.server.manager.internal.roles	MRS roles excluded from OBS path authorization Default value: Manager_administrator,Manager_auditor,Manager_operator,Manager_tenant,Manager_viewer,System_administrator,default,launcher-job Value: Add the role recorded in 1 to the default value. For example, if the recorded role is role1, set this parameter to the following: Manager_administrator,Manager_auditor,Manager_operator,Manager_tenant,Manager_viewer,System_administrator,default,launcher-job,role1
     token.server.manager.internal.groups	MRS user groups excluded from OBS path authorization Default value: hadoop,hadoopmanager,hive,kmsadmin,ficommon,yarnviewgroup Value: Add the user group recorded in 1 to the default value. For example, if the recorded user group is group1, set this parameter to the following: hadoop,hadoopmanager,hive,kmsadmin,ficommon,yarnviewgroup,group1

  4. Save the settings and restart the Guardian service.
  5. Resend the request.